registry / iobroker.blink / 0.0.23

iobroker.blink@0.0.23

adapter for amazon blink system and ioBroker

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface; suspicious primitives are tied to ioBroker Blink camera integration, video download, and local streaming. Runtime creates local helper objects/servers and contacts Blink services after adapter configuration.

Static reason

One or more suspicious static signals were detected.

Trigger

ioBroker adapter runtime with user-configured Blink credentials and optional streaming/live-view use

Impact

User-authorized Blink camera polling, snapshot/video storage, and local stream serving

Mechanism

Blink API client plus local MJPEG/HLS/video helper servers

Rationale

Static inspection found privileged runtime helpers, child process use, and local servers, but they are documented/package-aligned for ioBroker Blink camera live view and video serving. No install-time execution, unrelated exfiltration, destructive behavior, dependency confusion, or reviewer/AI control-surface mutation was found.

Evidence

package.jsonmain.jslib/blink-api.jslib/mjpeg-server.jslib/immi-live-hls.jslib/blink-liveview-iobroker.jslib/blink-video-url-server.json

Network endpoints4

api.oauth.blink.comrest-prod.immedia-semi.comrest-<tier>.immedia-semi.comcdnjs.cloudflare.com/ajax/libs/hls.js/1.5.20/hls.min.js

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

main.js installs/updates an ioBroker JavaScript object from lib/blink-video-url-server.json at runtime.
lib/blink-video-url-server.json contains an enabled local server script using ioBroker exec for CLI fallback and live-view helpers.
lib/immi-live-hls.js can spawn ffmpeg and a helper script for user-requested HLS live view.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks; main entry is main.js for ioBroker runtime.
Network code targets Blink/OAuth/API hosts and local streaming endpoints consistent with a Blink camera adapter.
Blink credentials/tokens are used for Blink login/session/cache and debug logs redact sensitive fields.
File writes are package-aligned snapshots/session/debug/HLS cache paths, not credential harvesting or arbitrary project mutation.
HTTP file serving checks path traversal for video/HLS paths and MJPEG endpoints require a generated token.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 233 KB of source, external domains: 127.0.0.1, api.oauth.blink.com

Source & flagged code

4 flagged

lib/blink-video-url-server.jsonView file

Lines 1-16json

2 "type": "script",

3 "common": {

4 "name": "blink-video-url-server",

5 "enabled": true,

6 "engine": "system.adapter.javascript.0",

7 "engineType": "Javascript/js",

8 "source": "/* global log, exec, getObject, getState, setState, existsState, existsObject, $, onStop */\n/* eslint-disable no-empty, no-useless-escape, @typescript-eslint/no-unused-vars */\n// ============================================================\n// Blink Multi-Camera Server + Grid + History + LiveView/HLS\n// http://<host>:8085/grid → All cameras in the grid including history and live\n// http://<host>:8085/cameras → camera JSON\n// http://<host>:8085/live/start?camera=ID → Start LiveView\n// http://<host>:8085/live/stop → Stop LiveVi ...

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/blink-video-url-server.jsonView on unpkg · L8

9 "debug": false,

10 "verbose": false

11 },

12 "native": {

13 "scriptVersion": "0.0.22"

14 }

15}

Long lines were clipped for display.

main.jsView file

Lines 1-25javascript

1'use strict';

2/*

3 * Created with @iobroker/create-adapter v3.1.2

4 */

6const utils = require('@iobroker/adapter-core');

7const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/immi-live-hls.js#virtual:normalized:round1View file

9const path = require('node:path'); L10: const tls = require('node:tls'); L11: const http = require('node:http'); L12: const { spawn, spawnSync } = require('node:child_process'); L13: L14: const SESSION_JSON = process.argv[2] || process.env.IMMI_SESSION_JSON || '/tmp/blink_liveview_session.json'; L15: const SERIAL = process.env.IMMI_SERIAL || process.env.BLINK_DEVICE_SERIAL || 'G8T1940153360515';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/immi-live-hls.js#virtual:normalized:round1View on unpkg · L9

Source & flagged code

4 flagged · loading source

lib/blink-video-url-server.jsonView file

8patternName = generic_password severity = medium line = 8 matchedText = "source"...\n",

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/blink-video-url-server.jsonView on unpkg · L8

main.jsView file

1694async startHlsProxy(devId, live) { L1695: const { spawn } = require('node:child_process'); L1696: await this.startHlsServer();

High

Child Process

Package source references child process execution.

main.jsView on unpkg · L1694

5L6: const utils = require('@iobroker/adapter-core'); L7: const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

main.jsView on unpkg · L5

lib/immi-live-hls.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/immi-live-hls.js#virtual:normalized:round1View on unpkg · L9

Findings

2 High3 Medium4 Low

HighChild Processmain.js

HighSame File Env Network Executionlib/immi-live-hls.js#virtual:normalized:round1

MediumSecret Patternlib/blink-video-url-server.json

MediumDynamic Requiremain.js

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

lib/blink-video-url-server.jsonView file

Lines 1-16json

2 "type": "script",

3 "common": {

4 "name": "blink-video-url-server",

5 "enabled": true,

6 "engine": "system.adapter.javascript.0",

7 "engineType": "Javascript/js",

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/blink-video-url-server.jsonView on unpkg · L8

9 "debug": false,

10 "verbose": false

11 },

12 "native": {

13 "scriptVersion": "0.0.22"

14 }

15}

Long lines were clipped for display.

main.jsView file

Lines 1-25javascript

1'use strict';

2/*

3 * Created with @iobroker/create-adapter v3.1.2

4 */

6const utils = require('@iobroker/adapter-core');

7const fs = require('node:fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/immi-live-hls.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/immi-live-hls.js#virtual:normalized:round1View on unpkg · L9

Lines 1674-1714javascript

1674 if (Object.prototype.hasOwnProperty.call(patch, 'active')) {

1675 await this.setStateAsync(`${base}.active`, !!patch.active, true);

1676 }

1677 if (Object.prototype.hasOwnProperty.call(patch, 'url')) {

1678 await this.setStateAsync(`${base}.url`, String(patch.url || ''), true);

1679 }

1680 if (Object.prototype.hasOwnProperty.call(patch, 'expires_at')) {

1681 await this.setStateAsync(`${base}.expires_at`, String(patch.expires_at || ''), true);

1682 }

1683 if (Object.prototype.hasOwnProperty.call(patch, 'last_error')) {

1684 await this.setStateAsync(`${base}.last_error`, String(patch.last_error || ''), true);

1685 }

1686 if (Object.prototype.hasOwnProperty.call(patch, 'session_id')) {

1687 await this.setStateAsync(`${base}.session_id`, String(patch.session_id || ''), true);

1688 }

1689 if (Object.prototype.hasOwnProperty.call(patch, 'backend')) {

1690 await this.setStateAsync(`${base}.backend`, String(patch.backend || ''), true);

1691 }

1692 }

1693

1694 async startHlsProxy(devId, live) {

1695 const { spawn } = require('node:child_process');

1696 await this.startHlsServer();

High

Child Process

Package source references child process execution.

main.jsView on unpkg · L1694

1697 const outDir = path.join(this.cfg.snapshotDir, 'live', devId);

1698 fs.mkdirSync(outDir, { recursive: true });

1699 const playlist = path.join(outDir, 'index.m3u8');

1700

1701 try {

1702 for (const f of fs.readdirSync(outDir)) {

1703 fs.unlinkSync(path.join(outDir, f));

1704 }

1705 } catch {

1706 // ignore

1707 }

1708

1709 const args = [

1710 '-rtsp_transport',

1711 'tcp',

1712 '-i',

1713 String(live.sourceUrl || ''),

1714 '-an',